[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Cybersecurity of Genomic Data:

| Potential Privacy Problems........................................................................................9                 |                                                                                |
| 3.3. | Discrimination and Reputational Concerns..............................................................10                            |                                                                                |
| 3.4. | Economic Concerns.................................................................................................11                |                                                                                |
| 3.5. | Health Outcome Concerns ......................................................................................11                    |                                                                                |
| 3.6. | Other Potential Future Concerns.............................................................................11                      |                                                                                |
| 3.7.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Security of Interactive and Automated Access Management Using Secure Shell (SSH):

access control; authentication; automated access management; device authentication; interactive access management; Secure Shell (SSH); user authentication

| 1. | Introduction ...................................................................................................................... 1   | Introduction ...................................................................................................................... 1                                                                                | Introduction ......................................................................................................................

Security of Interactive and Automated Access Management Using Secure Shell (SSH)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Security Best Practices for the Electronic Transmission of Election Materials for UOCAVA Voters:

| 5 OTHER RESOURCES.................................................................... | 5 OTHER RESOURCES.................................................................... | 42 |
| PRACTICES.... | PRACTICES.... | PRACTICES....

Security Best Practices for the Electronic Transmission of Election Materials for UOCAVA Voters


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to National Checklist Program for IT Products_ Guidelines for Checklist Users and Developers:

Security checklists, when developed correctly, can help users configure IT products so that they have more protection than the defaults provide. Applying checklists to operating systems and applications can reduce the number of vulnerabilities that attackers can attempt to exploit and lessen the impact of successful attacks. Using checklists improves the consistency and predictability of system security, particularly in conjunction with user training and awareness activities and other supporting security controls. Additional benefits associated with using checklists include the following:

National Checklist Program for IT Products_ Guidelines for Checklist Users and Developers


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Media Protection?

[Assistant]
According to Usability and Security Considerations for Public Safety Mobile Authentication:

The activities falling under emergency medical services are broad and far ranging, including patient care, food and drug safety, mass fatality management, and guidance on waste disposal. For the purposes of this report, we consider EMS personnel defined as "the individuals who provide pre-hospital emergency medical care and patient transportation" [8].

Usability and Security Considerations for Public Safety Mobile Authentication


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to IoT Device Cybersecurity Guidance for the Federal Government_ IoT Device Cybersecurity Requirement Catalog:

| SU - SOFTWARE                                                                                | UPDATE.................................................................................. 27   |
|--------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------|
| (UPD) Update Capabilities ............................................................................27     |                                                                                |
| (APP) Update Application Support................................................................28           |                                                                                |
| CS - CYBERSECURITY STATE AWARENESS...................................................

IoT Device Cybersecurity Guidance for the Federal Government_ IoT Device Cybersecurity Requirement Catalog


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Contingency Planning Guide for Federal Information Systems provide? (Part 4)

[Assistant]
FISMA requires that federal agencies comply with these standards, agencies may not waive their use. - Guidance documents and recommendations are issued in the NIST Special Publication (SP) 800series.
Office of Management and Budget (OMB) policies (including OMB FISMA Reporting Instructions for the Federal Information Security Management Act and Agency Privacy Management) state that, for other than national security programs and systems, agencies must follow NIST guidance. 1
- Other security-related publications, including NIST interagency and internal reports (NISTIRs) and ITL Bulletins, provide technical and other information about NIST's activities. These publications are mandatory only when so specified by OMB. 1 While agencies are required to follow NIST guidance in accordance with OMB policy, there is flexibility within NIST's guidance in how agencies apply the guidance. Unless otherwise specified by OMB, the 800-series guidance documents published by NIST generally allow agencies some latitude in the application. Consequently, the application of NIST guidance by agencies can result in different security solutions that are equally acceptable, compliant with the guidance, and meet the OMB definition of adequate security for federal information systems. When assessing federal agency compliance with NIST guidance, auditors, evaluators, and assessors should consider the intent of the security concepts and principles articulated within the particular guidance document and how the agency applied the guidance in the context of its specific mission responsibilities, operational environments, and unique organizational conditions. ## Acknowledgements

The authors, Marianne Swanson and Pauline Bowen of the National Institute of Standards and Technology (NIST), Amy Wohl Phillips, Dean Gallup, and David Lynes of Booz Allen Hamilton, wish to thank their colleagues who reviewed drafts of this document and contributed to its technical content.

Contingency Planning Guide for Federal Information Systems

Planning
System and Services Acquisition
Physical Protection
Awareness and Training
Incident Response
Supply Chain Risk Management
Configuration Management
Maintenance
Security Assessment
System and Communications Protection
Media Protection
Risk Assessment
Audit and Accountability
Personnel Security
Identification and Authentication
Access Control
System and Information Integrity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Automation Support for Security Control Assessments_ Software Vulnerability Management:

This publication, Volume 4 of NISTIR 8011, immediately follows Hardware Asset Management (HWAM) and Software Asset Management (SWAM) capabilities published as Volumes 2 and 3 respectively. Although it was planned to be released as Volume 5, following Configuration Settings Management (CSM), the VUL capability is being addressed as Volume 4 in the NISTIR 8011 series due to its close relationship with software. Its objective is to address the management of risk created by defects present in software on the network. A software vulnerability is caused by one or more known defects that have been discovered in software, and that can be exploited to affect an adverse security or privacy outcome. 1 Vulnerable software is software in use on a system that has a software vulnerability but has not yet been patched or otherwise mitigated. The Common Weakness Enumeration (CWE) provides identifiers for weaknesses that result from poor design or coding practices and have the potential to result in software vulnerabilities. The Common Vulnerabilities and Exposures (CVEs) program works with software providers, vulnerability coordinators, bug bounty programs, and vulnerability researchers to provide a list of publicly disclosed vulnerabilities. Together, CVE and CWE are used to identify software defects and the weaknesses that caused a given defect respectively. Vulnerable software is a key target that attackers use to initiate an attack and to expand control within a system. Patching vulnerabilities discovered in existing software and improving coding practices for future releases of software are two ways to limit the success of attacks. When known software vulnerabilities are unmanaged, uncorrected, or undetected, software is left open to exploitation. As a result, vulnerable software is a key target that attackers use to initiate an attack on an organization's network and expand control to attack other components on that network.

Automation Support for Security Control Assessments_ Software Vulnerability Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What are the CMMC Level 1 requirements?

[Assistant]
According to Workshop Summary Report for “Cybersecurity Risks in Consumer Home Internet of Things (IoT) Products” Virtual Workshop:

## NISTIR 8333

## Workshop Summary Report for 'Cybersecurity Risks in Consumer Home Internet of Things (IoT) Devices' Virtual Workshop

Katerina N. Megas Michael Fagan Barbara Cuthill Mary Raguso John Wiltberger

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8333

<!-- image -->

## NISTIR 8333

## Workshop Summary Report for 'Cybersecurity Risks in Consumer Home Internet of Things (IoT) Devices' Virtual Workshop

Katerina N. Megas Michael Fagan Barbara Cuthill

Applied Cybersecurity Division Information Technology Laboratory

Mary Raguso John Wiltberger The MITRE Corporation McLean, VA

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8333

March 2021

<!-- image -->

U.S. Department of Commerce Gina Raimondo, Secretary

National Institute of Standards and Technology James K. Olthoff, Performing the Non-Exclusive Functions and Duties of the Under Secretary of Commerce for Standards and Technology & Director, National Institute of Standards and Technology

## National Institute of Standards and Technology Interagency or Internal Report 8333 23 pages (March 2021)

## This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8333

Certain  commercial  entities,  equipment,  or  materials  may  be  identified  in  this  document  in  order  to  describe  an experimental  procedure  or  concept  adequately. Such  identification  is  not  intended  to  imply  recommendation  or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications.

Workshop Summary Report for “Cybersecurity Risks in Consumer Home Internet of Things (IoT) Products” Virtual Workshop


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Attribute-based Access Control for Microservices-based Applications using a Service Mesh:

d for ubiquitous access to these applications from multiple remote locations using different types of devices, it is necessary to build the concept of zero trust [1] into this application environment.
Zero trust assumes that there is no implicit trust granted to assets or user accounts based solely on their physical or network location (i.e., local area networks versus the internet) or based on asset ownership (enterprise or personally owned) [1]. Zero trust focuses on protecting resources (e.g., assets, services, workflows, and network accounts) rather than network segments since the network location is no longer seen as the prime component to the security posture of the resource. Furthermore, the loosely coupled nature of the components (i.e., microservices) of these cloud-native applications facilitates independent design, development, and agile deployment (e.g., Continuous Integration/ Continuous Delivery or Deployment (CI/CD) [2]) of the constituent microservices, enabling paradigms such as DevSecOps [3] (representing Development, Security and Operations) to be used.

Attribute-based Access Control for Microservices-based Applications using a Service Mesh


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Mapping Relationships Between Documentary Standards, Regulations, Frameworks, and Guidelines_ Developing Cybersecurity and Privacy Concept Mappings:

a particular technology (e.g., mobile, semiconductors) to map the components of that technology to NIST-catalogued threats and countermeasures.

Mapping Relationships Between Documentary Standards, Regulations, Frameworks, and Guidelines_ Developing Cybersecurity and Privacy Concept Mappings


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Guidelines on Security and Privacy in Public Cloud Computing:

| Executive Summary.................................................................................................................vi     | Executive Summary.................................................................................................................vi     | Executive Summary.................................................................................................................vi     |
|------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------|
| 1. Introduction....................................................................................................................... 1 | 1. Introduction....................................................................................................................... 1 | 1. Introduction....................................................................................................................... 1 |
| 1.1                                                                                | Authority                                                                                | ..................................................................................................................... 1                  |
| 1.2                                                                                | Purpose and Scope....................................................................................................

Guidelines on Security and Privacy in Public Cloud Computing


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to De-Identifying Government Datasets_ Techniques and Governance:

| 4. Technical Steps for Data De-Identifcation   | 4. Technical Steps for Data De-Identifcation                              | . . . . . . . . . . . . . . . . . . . . . . |   46 |
|------------------------------------------------|---------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------|------|
| 4.1. | Determine the Privacy, Data Usability, and Access Objectives . . . . . . | . . |   46 |
| 4.2. | Conducting a Data Survey . . . . . . . . . . . . . | . . . . . . . . . . . . . . . |   47 |
| 4.3. | De-Identifcation by Removing Identifers and Transforming Quasi-Identifers | De-Identifcation by Removing Identifers and Transforming Quasi-Identifers                                                                      |   49 |
|                                                | 4.3.1. | Removing or Transforming of Direct Identifers . . . . . . . . . . . . |   51 |
|                                                | 4.3.2. | Special Security Note Regarding the Encryption or Hashing of Di- rect Identifers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . |   52 |
|                                                | 4.3.3. | De-Identifying Numeric Quasi-Identifers . . . . . . . . . . . . . . . . |   53 |
|                                                | 4.3.4. | De-Identifying Dates . . . . . . . . . . . . . . . . . . . . . . . . . . . |   54 |
|                                                | 4.3.5. | De-Identifying Geographical Locations and Geolocation Data . . . |   55 |
|                                                | 4.3.6. | De-Identifying Genomic Information . . . . . . . . . . . . . . . . . . |   56 |
|                                                | 4.3.7. | De-Identifying Text Narratives and Qualitative Information . . . . . |   57 |
|                                                | 4.3.8.

De-Identifying Government Datasets_ Techniques and Governance


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Managing the Security of Information Exchanges provide? (Part 4)

[Assistant]
. However, it is recognized that the information being exchanged also requires the same or similar level of protection as it moves from one organization to another (protection commensurate with risk).
This publication focuses on managing the protection of the information being exchanged or accessed before, during, and after the exchange and provides guidance on identifying information exchanges, considerations for protecting exchanged information, and the agreement(s) needed to help manage the risk associated with exchanging information. This publication does not provide implementation guidance on any particular type of technology-based connection, information access, or exchange method. Organizations are expected to tailor the guidance to meet specific organizational needs and requirements regarding the information exchange. ## Keywords

agreements; connection; information exchange; information exchange agreement; interconnection; interconnection security agreement; memoranda of agreement; memoranda of understanding; nondisclosure agreement; protection requirements; risk management; service level agreement; user agreement. ## Acknowledgments

The authors - Kelley Dempsey, Victoria Yan Pillitteri, and Andrew Regenscheid - wish to thank their colleagues who reviewed drafts of this publication and provided valuable input, including Joseph Boone, Joshua Finney, Stephen Ford, Greg Frassmann, Ann Galchutt, Jay Gazlay, Nedim Goren, Alan McClelland, Douglas Montgomery, Thomas Ritz, Scott Rose, John Simms, and Scott Spitnale . The authors also gratefully acknowledge Editorial Review Board reviewers Alan McClelland and Michael Bartock, the work of the original authors of SP 800-47, Tim Grance, Joan Hash, Steven Peck, Jonathan Smith, and Karen Korow-Diks; and the preliminary updates made by Michael Nieles.

Managing the Security of Information Exchanges


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Cybersecurity Framework Version 1.1 Manufacturing Profile:

- A method to identify opportunities for improving the current cybersecurity posture of the manufacturing system - An evaluation of their ability to operate the control environment at their acceptable risk level - A standardized approach to preparing the cybersecurity plan for ongoing assurance of the manufacturing system's security | Function Unique Identifier | Function | Category Unique Identifier | Category | |------------------------------|------------|------------------------------|--------------------------------------------------------| | ID | Identify | ID.AM | Asset Management | | ID | Identify | ID.BE | Business Environment | | ID | Identify | ID.GV | Governance | | ID | Identify | ID.RA | Risk Assessment | | ID | Identify | ID.RM | Risk Management Strategy | | ID | Identify | ID.SC | Supply Chain Management | | PR | Protect | PR.AC | Identity Management, Authentication and Access Control | | PR | Protect | PR.AT | Awareness and Training | | PR | Protect | PR.DS | Data Security | | PR | Protect | PR.IP | Information Protection Processes and Procedures | | PR | Protect | PR.MA | Maintenance | | PR | Protect | PR.PT | Protective Technology | | DE | Detect | DE.AE | Anomalies and

Cybersecurity Framework Version 1.1 Manufacturing Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Foundations of a Security Policy for Use of the National Research and Educational Network:

The U.S. Government has since 1984 become increasingly aware of the essential role played by information technology in practically all areas of research and development. Bell reports [BELL88], the U.S. Congress requested in 1986 that OSTP study the potential development of a communications network for research computers, including supercomputers at universities and Federal research facilities. In recent years, a number of agencies, committees, and councils have been instrumental in the advising the government in its planning for HPCC and national networking -

Foundations of a Security Policy for Use of the National Research and Educational Network


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Security Considerations for Voice Over IP Systems:

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST)  promotes  the  U.S. economy  and  public  welfare  by  providing  technical  leadership  for  the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analysis to advance the development and productive use of information technology. ITL's responsibilities include the development of technical, physical, administrative, and management standards and guidelines for the cost-effective security and privacy of sensitive unclassified information in Federal computer systems. VOIP is still an emerging technology, so it is difficult to develop a complete picture of what a mature worldwide VOIP network will one day look like. As the emergence of SIP has shown, new technologies and new protocol designs have the ability to radically change VOIP. Although there are currently many different architectures and protocols to choose from, eventually a true standard will emerge. Unless a widely used open standard emerges, solutions will be likely to include a number of proprietary elements, which can limit an enterprise's future choices. The most widely used of the competing standards are SIP and H.323. Some observers believe that SIP will become dominant. Major vendors are investing an increasing portion of their development effort into SIP products. An extension of SIP, the SIP for Instant Messaging and Presence Leveraging Extensions (SIMPLE) standard, is being incorporated into products that support Instant Messaging. Until a truly dominant standard emerges, organizations moving to VOIP should consider gateways and other network elements that support both H.323 and SIP. Such a strategy helps to ensure a stable and robust VOIP network in the years that come, no matter which protocol prevails.

Security Considerations for Voice Over IP Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice IR.L2-3.6.7 (NIST 3.6.7)?

[Assistant]
According to Derived PIV Application and Data Model Test Guidelines:

3.6.7).

Derived PIV Application and Data Model Test Guidelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Satellite Ground Segment_ Applying the Cybersecurity Framework to Satellite Command and Control:

- identify known and anticipated threats to the satellite ground segment and supporting infrastructure;
- protect the systems that the ground segment relies on through policy, training, resilience, and access control;
- detect a loss of ground segments' confidentiality, integrity, or availability;
- respond to confidentiality breaches of Telemetry, Tracking, and Command (TT&C) and a manipulation or loss of satellite commands or telemetry in a timely, effective, and resilient manner; and
- recover from anomalies in a timely, effective, and resilient manner.

Satellite Ground Segment_ Applying the Cybersecurity Framework to Satellite Command and Control


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Representation of PIV Chain-of-Trust for Import and Export provide?

[Assistant]
## NIST Special Publication 800-156

## Representation of PIV Chain-of-Trust for Import and Export

Hildegard Ferraiolo Ramaswamy Chandramouli Ketan Mehta Jason Mohler Stephen Skordinski Steven Brady

This publication is available free of charge from:

http://dx.doi.org/10.6028/NIST.SP.800-156

## C  O  M  P  U  T  E  R      S  E  C  U  R  I  T  Y

<!-- image -->

## NIST Special Publication 800-156

## Representation of PIV Chain-of-Trust for Import and Export

Hildegard Ferraiolo Ramaswamy Chandramouli Ketan Mehta Computer Security Division Information Technology Laboratory

Jason Mohler Stephen Skordinski Steven Brady Electrosoft Services Inc. Reston, VA

This publication is available free of charge from:

http://dx.doi.org/10.6028/NIST.SP.800-156

May 2016

<!-- image -->

U.S. Department of Commerce Penny Pritzker, Secretary

National Institute of Standards and Technology Willie May, Under Secretary of Commerce for Standards and Technology and Director

## Authority

This publication has been developed by NIST to further its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3541 et  seq. ,  Public Law 113283. NIST  is  responsible  for  developing  information  security  standards  and  guidelines,  including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority  over  such  systems. This  guideline  is  consistent  with  the  requirements  of  the  Office  of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and  binding  on  federal  agencies  by  the  Secretary  of  Commerce  under  statutory  authority.

Representation of PIV Chain-of-Trust for Import and Export


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. | 3.4.3. Enhancing Practices....................................................................................................................49      |                                                                                |
|-------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------|
| 3.5.1. Measuring C-SCRM Through Performance Measures................................................................52                                |                                                                                |
| References.........................................................................................................................................57 |                                                                                |
| Appendix A. C-SCRM Security Controls............................................................................................... | 63                                                                                |
| A.1.1.

Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Digital Identity Guidelines_ Authentication and Authenticator Management:

Additional information about this publication is available at https://csrc.nist.gov/pubs/
sp/800/63/B/4/final, including related content, potential updates, and document history.

This guideline provides recommendations on types of authentication processes,
including choices of authenticators, that may be used at various authentication
assurance levels (AALs). It also provides recommendations on events that may occur
during the lifetime of authenticators, including initial issuance, maintenance, and
invalidation in the event of loss or theft of the authenticator.

Possession and control of a physical authenticator are based on proof of possession
of a secret associated with the authenticator. When an embedded secret (typically a
certificate and associated private key) is in the endpoint, its “device identity” can be
considered a physical authenticator. However, this requires a secure authentication
protocol that is appropriate for the AAL being authenticated. Browser cookies do not
satisfy this requirement except as short-term secrets for session maintenance (not
authentication), as described in Sec. 5.1.1.

Digital Identity Guidelines_ Authentication and Authenticator Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Guide to SSL VPNs:

-  The organization is limited to the VPN functionality offered by its firewall vendor. It does not have the option of using a VPN appliance because appliances are separate hardware devices. -  The firewall is directly accessible by external users on TCP port 443. This increases the likelihood of a vulnerability on the firewall that can be exploited via these ports. -  The firewall must be augmented by SSL VPN functionality. This additional code could introduce potential vulnerabilities to the firewall. the VPN tunnel. It sends all traffic not destined for the internal (protected) network through its standard network connection and only sends traffic destined for the internal network through the VPN tunnel. Split tunneling offers the advantages of efficiency and bandwidth conservation, as traffic destined for the Internet does not have to be sent first to the VPN device. On the other hand, split tunneling also creates a potential security vulnerability. If an attacker from the Internet compromises the client machine, then this attacker can use the split tunnel to also access the organization's internal network. The organization must weigh the advantages and disadvantages of split tunneling before deciding to implement it. -  Security of the Implementation. Parts of the SSL VPN's implementation, such as the SSL code or the firewall code, may contain vulnerabilities that attackers could exploit. Organizations with high security requirements may want to perform extensive vulnerability assessments against the SSL VPN components. At a minimum, the testers should update the SSL VPN components with the latest patches and configure the components following sound security practices. If the device supports features to protect against cross-site scripting, Structured Query Language (SQL) injection, and buffer overflow attacks, then these features should be enabled. -  Endpoint Security.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Cybersecurity for Smart Inverters_ Guidelines for Residential and Light Commercial Solar Energy Systems:

1. IR 8259A, IoT Device Cybersecurity Core Baseline [1], defines a baseline of six technical cybersecurity capabilities that IoT devices provide through their own technical means (i.e., device hardware and software).
2. IR 8259B, IoT Non-Technical Supporting Capability Core Baseline [2], defines a baseline of four non-technical cybersecurity capabilities that a manufacturer or third-party organization performs in support of the cybersecurity of an IoT device (e.g., providing information about software updates, instructions for configuration settings, and supply chain information).

Device cybersecurity capabilities are cybersecurity features or functions that IoT devices provide through their own technical means (i.e., device hardware and software). Non-technical supporting capabilities are actions that a manufacturer or third-party organization performs in support of the cybersecurity of an IoT device (e.g., providing information about software updates, instructions for configuration settings, and supply chain information). Used together, device cybersecurity capabilities and non-technical supporting capabilities can help mitigate cybersecurity risks related to the use of IoT devices while assisting customers in achieving their goals.

Cybersecurity for Smart Inverters_ Guidelines for Residential and Light Commercial Solar Energy Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Small Business Information Security_ The Fundamentals provide? (Part 4)

[Assistant]
.................................... PURPOSE ...........................................................................................................................................................
| 1 1   |
|------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------|
| 1          | BACKGROUND: WHAT IS INFORMATION SECURITY AND CYBERSECURITY?.............................................. | BACKGROUND: WHAT IS INFORMATION SECURITY AND CYBERSECURITY?.............................................. | 2     |
|            | 1.1                                                                                | WHY SMALL BUSINESSES?

Small Business Information Security_ The Fundamentals

Planning
System and Services Acquisition
Physical Protection
Awareness and Training
Incident Response
Supply Chain Risk Management
Maintenance
System and Communications Protection
Security Assessment
Media Protection
Risk Assessment
Audit and Accountability
Personnel Security
Identification and Authentication
Access Control
System and Information Integrity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.7 (NIST 3.3.7)?

[Assistant]
According to Cybersecurity Framework Version 1.1 Manufacturing Profile:

3.3.7. 3.3.7. 3.3.7.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.1 (NIST 3.1.1)?

[Assistant]
According to The Federal Cybersecurity Awareness Workforce_ Professional Backgrounds, Knowledge, Skills, and Development Activities:

3.1.1 Security Awareness Roles and Percentage of Time... 3.1.1 Security Awareness Roles and Percentage of Time... 3.1.1 Security Awareness Roles and Percentage of Time...

The Federal Cybersecurity Awareness Workforce_ Professional Backgrounds, Knowledge, Skills, and Development Activities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Guide to Secure Web Services:

| | 3.5.4 | XACML.......................................................................................................3-25 | | |---------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------| | | 3.5.5 | Role of XML Schema in Implementing Access Control..............................3-28 | | | | 3.5.6 | Use of Specialized Security Metadata for Access Control | .........................3-29 | | 3.6 | Confidentiality and Integrity of Service to Service Interchanges............................3-30 | Confidentiality and Integrity of Service to Service Interchanges............................3-30 | | | | 3.6.1 | Transport Layer Confidentiality and Integrity: HTTPS................................3-30 | | | | 3.6.2 | XML Confidentiality and Integrity................................................................3-30 | | | | 3.6.3 | WS-Security for SOAP Confidentiality and Integrity | ...................................3-31 | | | 3.6.4 | Role of XML Gateways in Integrity Protection............................................3-32 | | | 3.7 | Accountability End-to-End throughout a Service Chain.........................................3-33 | Accountability End-to-End throughout a Service Chain.........................................3-33 | | | | 3.7.1 Audit in the SOA Environment....................................................................3-34 | 3.7.1 Audit in the SOA Environment....................................................................3-34 | | | | 3.7.2 | Non-Repudiation of Web Service Transactions..........................................3-34 | | | 3.8 | Availability of Web Services...................................................................................3-35 | Availability of Web Services...................................................................................3-35 | | | | 3.8.1 | Failover.......................................................................................................3-36 | | | | 3.8.2 | Quality of Service | .......................................................................................3-36 | | | 3.8.3 | Reliable Messaging | ....................................................................................3-37 | | | 3.8.4 | Handling Service Deadlock


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Recommended Criteria for Cybersecurity Labeling of Consumer Software:

- Supplier's declaration of conformity (self-attestation) where the declaration of conformity is performed by the organization that provides the software. This is a self-attestation against a defined set of criteria.
- Third-party  testing  or  inspection  where  there  is  determination  or  examination  of  the consumer software based on defined criteria.
- Third-party certification of the consumer software.

Recommended Criteria for Cybersecurity Labeling of Consumer Software


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Supplemental Information for the Interagency Report on Strategic U.S. Government Engagement in International Standardization to Achieve U.S. Objective:

Identity and Access Management and related standards enable the use of secure, interoperable digital identities and attributes of entities to be used across security domains and organizational boundaries.  Examples of entities include people, places, organizations, hardware devices, software applications, information artifacts, and physical items. Standards for identity and access management support identification, authentication, authorization, privilege assignment, and audit to ensure that entities have appropriate access to information, services, and assets.  In addition, many identity and access management standards include privacy features to maintain anonymity, unlinkability, untraceability, ensure data minimization, and require explicit user consent when attribute information may be shared among entities.

CSA: The Cloud Security Alliance (CSA) is dedicated to defining and raising awareness of best practices and the development of industry standards to help ensure a secure cloud computing environment.  Present cybersecurity related standards include: the Cloud Control Matrix (CCM), a security control framework specifically dedicated to Cloud Computing; Consensus Assessment Initiative Questionnaire (CAIQ), a due diligence framework to guide organizations in the assessment of the CCM controls implementation; CloudAudit, a common interface and namespace that allows enterprises to streamline their audit processes; and Privacy Level Agreement (PLA), a guidance to achieve a baseline compliance with mandatory personal data protection legislation across the European Union (EU).

Security 28 may also be defined as the preservation of confidentiality, integrity and availability of information.  NOTE In addition, other properties, such as authenticity, accountability, nonrepudiation, and reliability can also be relevant.

Supplemental Information for the Interagency Report on Strategic U.S. Government Engagement in International Standardization to Achieve U.S. Objective


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices:

| C.3.3 Human Resource Management ........................................................................................74 | | |-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------| | C.3.3.1 HR Strategy Information Type..................................................................................74 | | | C.3.3.2 Staff Acquisition Information Type..........................................................................75 | | | C.3.3.3 Organization &Position Management Information Type.........................................76 | | | C.3.3.4 Compensation Management Information Type.........................................................77 | | | C.3.3.5 Benefits Management Information Type | ..................................................................78 | | C.3.3.6 Employee Performance Management Information Type..........................................79 | | | C.3.3.7 Employee Relations Information Type | .....................................................................81 | | C.3.3.8 Labor Relations Information Type............................................................................82 | | | C.3.3.9 Separation Management Information Type...............................................................83 | | | C.3.3.10 Human Resources Development Information Type................................................84 | | | C.3.4 Supply Chain Management..............................................................................................85 | | | C.3.4.1 Goods Acquisition Information Type | .......................................................................85 | | C.3.4.2 Inventory Control Information Type.........................................................................87 | | | C.3.4.3 Logistics Management Information Type.................................................................88 | | | C.3.4.4 Services Acquisition Information Type | ....................................................................89 | | C.3.5 Information and Technology Management......................................................................91 | | | C.3.5.1 System Development Information Type | ...................................................................91 | | C.3.5.2 Lifecycle/Change Management Information Type | ...................................................92 | | C.3.5.3 System Maintenance Information Type....................................................................93 | | | C.3.5.4 IT Infrastructure Maintenance Information Type | .....................................................94 | | C.3.5.5 Information Security Information Type....................................................................96 | | | C.3.5.6 Record Retention Information Type..........................................................................97 | | | C.3.5.7 Information Management Information

Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Computer Security Division 2007 Annual Report provide? (Part 4)

[Assistant]
to  meet  new  and revised requirements for federal agency use of cryptographic systems, and to address technological and economic changes that have occurred since the issuance of FIPS 140-2 in 2001.
Opportunities were presented during FY 2007 for CSD to apply its security research  to  national  priorities  and  internal  NIST  initiatives. The  CSD significantly expanded its support for two key national initiatives, electronic voting  and  health  information  technology,  by  researching  the  security requirements  of  those  areas  and  applying  the  results  of  that  research, along with current technologies, in furtherance of the stated goals of those initiatives. CSD also worked closely with the NIST ITL management team to integrate security projects into newly formed research programs. These programs, which include Cyber Security, Pervasive Information Technologies, Trustworthy Networking, and  Trustworthy Software, are designed to organize  and  build  ITL  core  competencies  in  the  most  efficient  manner, and to maximize the use of ITL resources to address emerging information technology challenges. These are just some of the highlights of the CSD program during FY 2007. You may obtain more information about CSD's program at http://csrc.nist.gov or by contacting any of the CSD experts noted in this report. If interested in participating in any CSD challenges -whether current or future - please contact any of the listed CSD experts.

Computer Security Division 2007 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Maintenance?

[Assistant]
According to Fiscal Year 2023 Cybersecurity and Privacy Annual Report:

- NIST continued the Journey to Cybersecurity Framework (CSF) 2.0 by releasing a CSF 2.0 Concept Paper, publishing a discussion draft of the CSF 2.0 Core, and issuing a draft CSF 2.0 with Core Implementation examples. Additionally, NIST published an analysis of comments received on each draft and hosted two hybrid workshops (1 st  workshop & 2 nd  workshop). - NIST continued to lead and support community engagement on cybersecurity supply chain risk management through the Software and Supply Chain Assurance (SSCA) Forum, support the Federal Acquisition Security Council, and refine supply-chain guidance in SP 800-161 Revision 1, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations . - NIST issued a working draft of the SP 800-55 Rev. 2, Performance Measurement Guide for Information Security for community discussion and feedback and hosted a cybersecurity measurement workshop on the current state of cybersecurity performance measurement, needs, and path forward. - NIST initiated updates to the Protecting Controlled Unclassified Information (CUI) Series, issued a pre-call for comment, released an initial public draft of SP 800-171r3, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, and hosted a webinar to provide an overview of the draft. - NIST launched the Cybersecurity & Privacy Reference Tool (CPRT) - an online application that provides NIST guidance and frameworks in a consistent format for reference data and allows users to understand the relationships between NIST resources. - NIST continued the development of the Open Security Controls Assessment Language (OSCAL) - a set of eXtensible Markup Language (XML), JavaScript Object Notation (JSON), and Ain't Mark-up Language (YAML) formats that provide machine-readable representations of security and privacy information relative to the implementation, assessment, and continuous monitoring of systems.

Fiscal Year 2023 Cybersecurity and Privacy Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Interfaces for Personal Identity Verification_ Part 2 – PIV Card Application Card Command Interface:

FIPS 201 defines the requirements and characteristics of government-wide interoperable identity credentials. It specifies that these identity credentials must be stored on a smart card and that additional common identity credentials, known as derived PIV credentials, may be issued by a federal department or agency and used when a PIV Card is not practical. This document contains the technical specifications to interface with the smart card to retrieve and use the PIV identity credentials. The specifications reflect the design goals of interoperability and PIV Card functions. The goals are addressed by specifying a PIV data model, card edge interface, and application programming interface. Moreover, this document enumerates requirements for the options and branches in international integrated circuit card standards [ISO7816]. The specifications go further by constraining interpretations of the normative standards to ease implementation, facilitate interoperability, and ensure performance in a manner tailored for PIV applications. | 1. Introduction...................................................................................................................................1    |
|--------------------------------------------------------------------------------------------------------------------------------------------------------|
| 2. Overview: Concepts and Constructs................................................................................................3                  |
| 2.3.1. Default Selected Card Application................................................................................................4              |
| 2.4.1. Access Control Rule......................................................................................................................5      |
| 2.4.2. Security Status..............................................................................................................................5  |
| 2.4.3.

Interfaces for Personal Identity Verification_ Part 2 – PIV Card Application Card Command Interface


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Guidelines for Smart Grid Cybersecurity:

EXECUTIVE SUMMARY .................................................................................................................. IX
Content of the Report ............................................................................................................................ xi
 CHAPTER 1   DOCUMENT DEVELOPMENT STRATEGY ...................................................................1
1.1  Cybersecurity and the Electric Sector ............................................................................................ 4
1.2  Scope and Definitions .................................................................................................................... 5
1.3  Smart Grid Cybersecurity Document Development Strategy ........................................................ 6
1.4  Combined Cyber-Physical Attacks .............................................................................................. 12
 CHAPTER 2   LOGICAL ARCHITECTURE AND INTERFACES OF THE SMART GRID ......................14
2.1  The Seven Domains to the Logical Reference Model ................................................................. 15
2.2  Logical Security Architecture Overview ..................................................................................... 24
2.3  Logical Interface Categories ........................................................................................................ 28
 CHAPTER 3  HIGH-LEVEL SECURITY REQUIREMENTS ...............................................................75
3.1  Cybersecurity Objectives ............................................................................................................. 75
3.2  Confidentiality, Integrity, and Availability Impact Levels .......................................................... 76
Impact Levels for the CI&A Categories ......................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to 3rd High-Performance Computing Security Workshop_ Joint NIST-NSF Workshop Report:

The panel identified software supply chain security as both a current and future challenge, especially in HPC, where code provenance is largely unknown and users compile their own code. Asked how they might redesign HPC systems to be more secure, one panelist emphasized the power of virtualization, containers, and the ability to limit the attack surface. The panel discussed the relative merits, performance, and obstacles to such a pure container-based approach.

- Composable/disaggregated systems (CXL) and their implications on architectures
- Multi-tenancy: Exploring how to efficiently share resources among multiple users or applications
- Supply chain security: Ensuring the integrity and security of hardware components throughout the supply chain
- Real-time authorization of components: Enabling the verification and authorization of components in real time
- Transition from Trusted Platform Module 2.0 (TPM2) to Virtual TPM (VTPM): Evaluating the benefits and challenges of transitioning from TPM2 to Virtual TPM
- SmartNICs and the software executed on them: Understanding the role of SmartNICs and the software running on them for enhancing system performance and security
- Software-defined networks (SDNs): Leveraging SDNs to enable more flexible and efficient network management

- Transition to RMF and the subsequent move to the Cybersecurity Maturity Model Certification (CMMC) in the coming decade
- Zero trust approach and its relevance to HPC systems: Implementing a zero trust architecture that assumes no inherent trust in the system components and networks
- Supply chain management: Developing strategies to mitigate the risks associated with the supply chain, including hardware and software components

3rd High-Performance Computing Security Workshop_ Joint NIST-NSF Workshop Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for System and Information Integrity?

[Assistant]
According to Computer Security Division 2010 Annual Report:

We also invite public and private organizations to submit their in formation security practices to be considered for inclusion on the website. Policies and procedures may be submitted to us in any area of information security, such as accreditation, audit trails, au thorization of processing, budget planning and justification, cer tification, contingency planning, data integrity, disaster planning, documentation, hardware and system maintenance, identification and  authentication,  incident  handling  and  response,  life  cycle, network security, personnel security, physical and environmental protection, production input/output controls, security policy, pro gram management, review of security controls, risk management, security  awareness  training  and  education  (including  specific training course and awareness materials), and security planning. Health information technology (HIT) makes it possible for health care providers to better manage patient care through secure use and  sharing  of  health  information,  leading  to  improvements  in healthcare quality, reduced medical errors, increased efficiencies in  care  delivery  and  administration,  and  improved  population health. Central  to  reaching  these  goals  is  the  assurance  of  the confidentiality,  integrity,  and  availability  of  health  information. The CSD works actively with government, industry, academia, and others to provide security tools, technologies, and methodologies that provide for the security and privacy of health information. As part  of  that  work,  CSD  participates  with,  and  provides  technical advice to, agencies, organizations, and standards committees and panels that are shaping the HIT arena, including the Department of Health and Human Services' (HHS), Office of the National Coor dinator for Health IT (ONC), and Office for Civil Rights (OCR).

Computer Security Division 2010 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Ordered t-way Combinations for Testing State-based Systems:

ement Concepts and Applications", 2nd  Intl  Workshop  on  Combinatorial  Testing , Luxembourg, IWCT2013, IEEE, Mar. 2013. - [27] Zamli KZ, Othman RR, Zabil MH. On sequence based interaction  testing.
In2011  IEEE  Symposium  on  Computers  & Informatics 2011 Mar 20 (pp. 662-667). IEEE. - [28] Kuhn DR, Higdon JM, Lawrence JF, Kacker RN, Lei Y. Efficient  methods  for  interoperability  testing  using  event sequences. FLIGHT TEST SQUADRON (46TH) EGLIN AFB FL; 2012 Aug 1. - [29] Yilmaz C, Fouche S, Cohen MB, Porter A, Demiroz G, Koc U. Moving forward with combinatorial interaction testing. Computer. 2013 Dec 11;47(2):37-45. - [30] Garn  B,  Simos  DE,  Zauner  S,  Kuhn  R,  Kacker  R. Browser fingerprinting using combinatorial sequence testing. In Proceedings of the 6th Annual Symposium on Hot Topics in the Science of Security 2019 Apr 1 (pp. 1-9). - [31] Ozcan  M. An  Industrial  Study  on  Applications  of Combinatorial  Testing  in  Modern  Web  Development. In2019 IEEE International Conference on Software Testing, Verification and Validation Workshops (ICSTW) 2019 Apr 22 (pp. 210-213). - [32] Ratliff, Z. B. (2018). Black-box Testing Mobile Applications  Using  Sequence  Covering  Arrays. undergraduate thesis, Texas A&M University. - [33] Ratliff ZB, Kuhn DR, Ragsdale DJ. Detecting Vulnerabilities in Android Applications using Event Sequences. In2019 IEEE 19th International Conference on Software Quality, Reliability and Security (QRS) 2019 Jul 22 (pp. 159-166). IEEE. - [34] Elks DC, Deloglos C, Jayakumar A, Tantawy DA, Hite R, Gautham S. Realization Of An Automated T-Way Combinatorial Testing Approach For A Software Based Embedded  Digital  Device. Idaho  National  Lab.(INL),  Idaho Falls, ID (United States); 2019 Jun 17. - [35] Becci G, Dhadyalla G, Mouzakitis A, Marco J, Moore AD. Robustness testing of real-time automotive systems using sequence covering arrays. SAE International Journal of

Ordered t-way Combinations for Testing State-based Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Identification and Authentication?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

| CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION...................................................................................................... |
|--------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------|
| 1.1 PURPOSEANDAPPLICABILITY                                                                                | ................................................................................................... 3                                            |
| 1.2 TARGET AUDIENCE                                                                                | .................................................................................................................. 4                             |
| 1.3 ORGANIZATIONOF THIS SPECIAL PUBLICATION                                                                                | .......................................................................... 4                                                                     |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        | CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ......................................................................................................

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Recommendation for Applications Using Approved Hash Algorithms provide? (Part 5)

[Assistant]
|
| 5                                                                                | Hash function Usage..........................................................................
| Hash function Usage.......................................................................... | 9                                                                                |
|                                                                                | 5.1                                                                                | Truncated Message Digest........................................................................ | 9                                                                                |
|                                                                                | 5.2                                                                                | Digital Signatures.................................................................................... | 10                                                                                |
|                                                                                |                                                                                | 5.2.1 Full-length Message                                                                                | Digests...................................................

Recommendation for Applications Using Approved Hash Algorithms

Planning
System and Services Acquisition
Physical Protection
Awareness and Training
Incident Response
Configuration Management
Maintenance
Security Assessment
System and Communications Protection
Media Protection
Risk Assessment
Audit and Accountability
Personnel Security
Identification and Authentication
Access Control
System and Information Integrity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Security Considerations for Remote Electronic UOCAVA Voting:

s, monitor how voters vote, and use the election official's credential to gain and expand access to damage the voting system, change election results, and harm the credibility of the election results.
Although the election official is not actively participating in attacking the remote electronic voting system, the console they use to interact with the voting system poses a threat that appears to be from an election official.

Security Considerations for Remote Electronic UOCAVA Voting


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Understanding Stablecoin Technology and Related Security Considerations:

This configuration is the most common (and is exclusively the case in the top 20 studied stablecoins).

Understanding Stablecoin Technology and Related Security Considerations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Recommended Criteria for Cybersecurity Labeling for Consumer Internet of Things (IoT) Products:

e not met by IoT product components and why (e.g., the capability is not needed based on risk assessment). - d. Product design and support considerations related to the IoT product, for example :
- i.
All hardware and software components, from all sources (e.g., open source, propriety third-party, internally developed) used to create the IoT product (i.e., used to create each product component). - ii. IoT platform used in the development and operation of the IoT product, its product components, including related documentation. - iii. Protection of software and hardware elements implemented to create the IoT product and its product components (e.g., secure boot, hardware root of trust, and secure enclave).

Recommended Criteria for Cybersecurity Labeling for Consumer Internet of Things (IoT) Products


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Access Control?

[Assistant]
According to Computer Security Division 2010 Annual Report:

Security and Health Information Technology National Initiative for Cybersecurity Education (NICE) | 9 14 | Access Control and Privilege Management Research Security for Grid and Pervasive Systems Security Ontologies: Modeling Quantitative Risk Analysis Enterprise Systems Protecting | 31 | | | 13 | NIST Cloud Computing Project Policy Machine | | | Security Practices and Policies Small and Medium Size Business Outreach | 12 12 | Automated Combinatorial Testing for Software Conformance Verification for Access Control Policies Forensics forWeb Services Mobile Handheld Device Security and Forensics | 31 32 33 33 | | | 11 11 | | | | | | | 34 | | | | | 35 35 36 | | Smart Grid Cyber Security | | | | | | | Virtualization Technologies Cloud Computing andVirtualization Laboratory | 36 36 36 | | Supply Chain Risk Management | 15 | | | | Cryptographic Validation Programs and Laboratory | 15 | Access Control and Identitiy Management in Virtualized Systems | 37 37 38 38 | | Accreditation Cryptographic ModuleValidation Program and Cryptographic | 16 16 17 18 | Security Content Automation Protocol (SCAP) National Vulnerability Database National Checklist Program Security Content Automation Protocol Validation Program |


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Computer Security Division 2014 Annual Report:

anonymity and credentials, and specific privacy-enhancing technologies. In the past year, NIST continued to support the EAC in finalizing changes to the Voluntary Voting System Guidelines (VVSG) 1.1.
The security guidelines were updated in FY 2012 to  improve  the  auditability  of  voting  systems,  to  provide greater software integrity protections, to expand  and improve  access-control  requirements,  and  to  help  ensure

Computer Security Division 2014 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Guidelines on Securing Public Web Servers:

| Introduction ......................................................................................................................1-1 | | | | | 1.1 | Authority...................................................................................................................1-1 | | | | 1.2 | Purpose and Scope .................................................................................................1-1 | | | | 1.3 | Audience and Assumptions .....................................................................................1-2 | | | | 1.4 Document | Structure.................................................................................................1-2 | | | 2.

Guidelines on Securing Public Web Servers


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to IoT Device Cybersecurity Guidance for the Federal Government_ IoT Device Cybersecurity Requirement Catalog:

| 29 | | (AEI) Access to Event Information | ................................................................29 | | (EIM) Event Identification & Monitoring | .........................................................29 | | (EVR) Event Response.................................................................................30 | | | (LCT) Logging Capture & Trigger Support | ....................................................31 | | (RDL) Support of Required Data Logging | .....................................................31 | | (LSR) Audit Log Storage & Retention ...........................................................32 | | | (SRT) Support for Reliable Time...................................................................32 | | | (AUP) Audit Support & Protection .................................................................33 | | | (AWR) State Awareness Support..................................................................34 | | | DS - DEVICE SECURITY .....................................................................................

IoT Device Cybersecurity Guidance for the Federal Government_ IoT Device Cybersecurity Requirement Catalog


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.3 (NIST 3.2.3)?

[Assistant]
According to Cybersecurity Framework Profile for Electric Vehicle Extreme Fast Charging Infrastructure:

3.2.3 OIML D31:2019 6.

Cybersecurity Framework Profile for Electric Vehicle Extreme Fast Charging Infrastructure


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines:

.............................9      |
| 3.1.5. Types of Exploits.........................................................................................................................10   |
| 3.2.1.
Baseline Security ........................................................................................................................11   |
| 3.2.2. Controls for Interacting With SCM Systems...............................................................................12                     |
| 4. CI/CD Pipelines -Background, Security Goals, and Entities to be Trusted .....................................13                                    |
| 5. Integrating SSC Security Into CI/CD Pipelines.................................................................................15                   |
| 5.1.1. Secure Build................................................................................................................................16 |
| 5.1.2. Secure Pull-Push Operations on Repositories............................................................................17                      |
| 5.1.3. Integrity of Evidence Generation During Software Updates......................................................18                               |
| 5.1.4. Secure Code Commits ................................................................................................................19         |

Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for System and Services Acquisition?

[Assistant]
According to Personal Identity Verification (PIV) of Federal Employees and Contractors:

In  the  case  of  deprecated  features  on  PIV  Cards  such  as  the  magnetic  stripe (Section  4.1.4.4),  existing  PIV  Card  stock  with  deprecated  features  remains  valid. However,  future  PIV  Card  stock  acquisitions SHOULD exclude  the  deprecated  features.

The  card  issuer SHALL maintain  the  enrollment  record  for  each  issued  PIV  Card.  These enrollment  records  are  created  and  maintained  through  the  methods  of  contemporaneous acquisition  at  each  step  of  the  PIV  issuance  process-typically  including  identity proofing,  registration,  and  biometric  enrollment.

- A  log  of  activities  that  documents  who  took  the  action,  what  action  was  taken,  when and  where  the  action  took  place,  and  what  data  was  collected.
- An  enrollment  data  record  that  contains  the  most  recent  collection  of  each  of  the biometric  data  collected.  The  enrollment  data  record  describes  the  circumstances of  biometric  acquisition  including  the  name  and  role  of  the  acquiring  agent,  the office  and  organization,  time,  place,  and  acquisition  method.  The  enrollment  data record MAY also  document  unavailable  biometric  data  or  failed  attempts  to  collect

Personal Identity Verification (PIV) of Federal Employees and Contractors


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Module-Lattice-Based Key-Encapsulation Mechanism Standard provide?

[Assistant]
<!-- image -->

## FIPS 203

## Federal Information Processing Standards Publication

## Module-Lattice-Based Key-Encapsulation Mechanism Standard

Category:

Computer Security

Subcategory:

Cryptography

Information Technology Laboratory National Institute of Standards and Technology Gaithersburg, MD 20899-8900

This publication is available free of charge from: https://doi.org/10.6028/NIST.FIPS.203

Published August 13, 2024

<!-- image -->

Commerce

U.S. Department of Gina M. Raimondo, Secretary

National Institute of Standards and Technology

Laurie E. Locascio, NIST Director and Under Secretary of Commerce for Standards and Technology

## Foreword

The Federal Information Processing Standards (FIPS) Publication Series of the National Institute of Standards and Technology is the official series of publications relating to standards and guidelines developed under 15 U.S.C. 278g-3, and issued by the Secretary of Commerce under 40 U.S.C. 11331. Comments concerning this Federal Information Processing Standard publication are welcomed and should be submitted using the contact information in the 'Inquiries and Comments' clause of the announcement section. Kevin M. Stine, Director Information Technology Laboratory

## Abstract

A key-encapsulation mechanism (KEM) is a set of algorithms that, under certain conditions, can be used by two parties to establish a shared secret key over a public channel. A shared secret key that is securely established using a KEM can then be used with symmetric-key cryptographic algorithms to perform basic tasks in secure communications, such as encryption and authentication. This standard specifies a key-encapsulation mechanism called ML-KEM. The security of ML-KEM is related to the computational difficulty of the Module Learning with Errors problem. At present, ML-KEM is believed to be secure, even against adversaries who possess a quantum computer. This standard specifies three parameter sets for ML-KEM.

Module-Lattice-Based Key-Encapsulation Mechanism Standard


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography:

s, Symbols and Abbreviations ............................................................... | 3. Definitions, Symbols and Abbreviations ...............................................................
| 2                                                                                |
|                                                                                | 3.1                                                                                | Definitions........................................................................................................................ | 2                                                                                |
|                                                                                | 3.2                                                                                | Symbols and Abbreviations ............................................................................................. | 9                                                                                |
| 4. Overview of Key-Establishment Schemes........................................................... | 4. Overview of Key-Establishment Schemes........................................................... | 4. Overview of Key-Establishment Schemes...........................................................

Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Recommendation for Random Bit Generator (RBG) Constructions:

| 1. Introduction and Purpose...............................................................................................................1       |
|---------------------------------------------------------------------------------------------------------------------------------------------------|
| 2. General Information.......................................................................................................................3    |
| 2.4.1. DRBG Instantiations......................................................................................................................8 |
| 2.4.2. Reseeding, Prediction Resistance, and Compromise Recovery ...................................................9                             |
| 2.8.1. DRBG Functions..........................................................................................................................15 |
| 2.8.1.1. DRBG Instantiation ...............................................................................................................15     |
| 2.8.1.2. DRBG Generation Request....................................................................................................17            |
| 2.8.1.3. DRBG Reseed ........................................................................................................................19   |
| 2.8.1.4. Get_randomness_source_input Call ....................................................................................20                  |
| 2.8.2. Interfacing With Entropy Sources ..............................................................................................20          |
| 2.8.3. Interfacing With an RBG3 Construction .....................................................................................21              |
| 2.8.3.1. Instantiating a DRBG Within an RBG3 Construction.............................................................21                          |
| 2.8.3.2.

Recommendation for Random Bit Generator (RBG) Constructions


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.3 (NIST 3.2.3)?

[Assistant]
According to Framework for Improving Critical Infrastructure Cybersecurity, Version 1.1:

3.2.3. 3.2.3. 3.2.3, A.

Framework for Improving Critical Infrastructure Cybersecurity, Version 1.1


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.1 (NIST 3.3.1)?

[Assistant]
According to Guidelines for Evaluating Differential Privacy Guarantees:

3.3.1. 3.3.1. 3.3.1.

Guidelines for Evaluating Differential Privacy Guarantees


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Recommendation for Key Management_ Part 2 – Best Practices for Key Management Organizations:

specifically authorized to access the information being protected. In asymmetric key cryptography, only one key in the key pair, the private key, must be kept secret; the other key can be made public.
Symmetric key cryptography is most often used to protect the confidentiality of information or to authenticate the integrity of that information. Asymmetric key cryptography is commonly used to protect the integrity and authenticity of information and to establish symmetric keys.

Recommendation for Key Management_ Part 2 – Best Practices for Key Management Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to National Checklist Program for IT Products_ Guidelines for Checklist Users and Developers:

-  Configuration files that automatically set or verify various security-related settings (e.g., executables, security templates that modify settings, Security Content Automation Protocol (SCAP) XML (Extensible Markup Language) files, and scripts). 4
-  Documentation (e.g., text file) that guides the checklist user to manually configure an IT product
-  Documents that explain the recommended methods to securely install and configure a device
-  Policy and programmatic documents that set forth guidelines for such things as auditing, authentication mechanisms (e.g., passwords), and perimeter security.

The Managed environment, also referred to as Enterprise , comprises centrally managed IT products, everything ranging from servers and printers to desktops, laptops, smartphones, and tablets. Managed checklists are intended for advanced end users and system administrators. The managed nature of typical Managed environments gives administrators centralized control over various settings on devices. Authentication, account, and policy management can also be administered centrally to maintain a consistent security posture across an organization.

National Checklist Program for IT Products_ Guidelines for Checklist Users and Developers